Re: significant incoming SSH volume

[Russell Fulton <r.fulton () AUCKLAND AC NZ>]

On 17/03/2010, at 9:46 AM, Mike Iglesias wrote:

> On 03/16/2010 01:07 PM, Justin Sipher wrote:
> > Hello all.  We have seen a drastic uptick in recent days for inbound SSH
> > connections to many of our servers.  These connection are attempting to
> > connect to our servers as ROOT and are coming from IP addressed
> > appearing to be mostly overseas.  They number in the thousands of
> > connections.  While we are confident in the strength of our passwords,
> > as you know with enough effort.......
> >
> > My questions to this group are:
> >
> >    * Is anyone else seeing this?
>
> About once a month we get hit by ~700 different IPs probing systems with port
> 22 open.

ditto and have been for at least a couple of years.

> >    * Are you doing anything to address this?  We are contemplating
> >      blocking SSH inbound on our firewall and requiring any external
> >      SSH connection to first connect to our VPN.  In some ways it seems
> >      excessive and maybe even unsustainable.  On the other hand,
> >      protecting our servers is important as you well know.
>
> We block all inbound traffic except to systems registered as servers, so there
> are a limited number of systems with port 22 exposed.

Same here at UoA.  

We also have an SSH gateway machine that staff can use from outside that uses certificates or 2fa and is thus immune to 
brute force attacks.  I would like to set up something similar for RDP.

R